# I have a log file in which i will search with a specific word which will give me that line but i need to get whole message. (started from "waiting for message" to another "waiting for message") **URL:** \ **Category:** Elasticsearch\ **Created:** [October 22, 2018, 10:42am UTC](https://discuss.elastic.co/t/i-have-a-log-file-in-which-i-will-search-with-a-specific-word-which-will-give-me-that-line-but-i-need-to-get-whole-message-started-from-waiting-for-message-to-another-waiting-for-message/153379 "2018-10-22T10:42:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![osamaikhlas](https://avatars.discourse-cdn.com/v4/letter/o/4bbf92/32.png) [@osamaikhlas](https://discuss.elastic.co/u/osamaikhlas)\ **Post date:** [October 22, 2018, 10:42am UTC](https://discuss.elastic.co/t/i-have-a-log-file-in-which-i-will-search-with-a-specific-word-which-will-give-me-that-line-but-i-need-to-get-whole-message-started-from-waiting-for-message-to-another-waiting-for-message/153379/1 "2018-10-22T10:42:31Z")
> 18/07/04 00:00:00 | main Waiting For A Message... > 18/07/04 00:00:00 | main G\_GetMsg XLI-38159714: Message Length Received [230] > 18/07/04 00:00:00 | main XLI-38159714: MessageSource [0028] > 18/07/04 00:00:00 | main company > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-011 6:[234548] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-012 6:[234748] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-013 4:[0703] > 18/07/04 00:00:00 | ProcessMessageXLI-38159714: DE-015 4:[0704] > 18/07/04 00:00:00 | main Waiting For A Message... > 18/07/04 00:00:00 | main G\_GetMsg XLI-38159714: Message Length Received [230] 18/07/04 00:00:00 | main XLI-38159714: MessageSource [0028] > 18/07/04 00:00:00 | main company > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-011 6:[234548] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-012 6:[234748] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-013 4:[0703] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-015 4:[0704] > 18/07/04 00:00:00 | main Waiting For A Message... > 18/07/04 00:00:00 | main Waiting For A Message... > 18/07/04 00:00:00 | main G\_GetMsg XLI-38159714: Message Length Received [230] > 18/07/04 00:00:00 | main XLI-38159714: MessageSource [0028] > 18/07/04 00:00:00 | main company > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-011 6:[234548] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-012 6:[234748] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-013 4:[0703] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-015 > 4:[0704] 18/07/04 00:00:00 | main Waiting For A Message... ---
**Author:** ![nugusbayevkk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nugusbayevkk/32/126683_2.png) [@nugusbayevkk](https://discuss.elastic.co/u/nugusbayevkk)\ **Post date:** [October 22, 2018, 11:30am UTC](https://discuss.elastic.co/t/i-have-a-log-file-in-which-i-will-search-with-a-specific-word-which-will-give-me-that-line-but-i-need-to-get-whole-message-started-from-waiting-for-message-to-another-waiting-for-message/153379/2 "2018-10-22T11:30:53Z")
hi, i think that you should parse you log file and then insert it to elasticsearch, you can use filebeat or logstasg, below is an example conf of filebeat: ### Multiline options `multiline.pattern: .*Waiting For A Message.*` `multiline.negate: true` `multiline.match: before` ---
**Author:** ![osamaikhlas](https://avatars.discourse-cdn.com/v4/letter/o/4bbf92/32.png) [@osamaikhlas](https://discuss.elastic.co/u/osamaikhlas)\ **Post date:** [October 22, 2018, 12:15pm UTC](https://discuss.elastic.co/t/i-have-a-log-file-in-which-i-will-search-with-a-specific-word-which-will-give-me-that-line-but-i-need-to-get-whole-message-started-from-waiting-for-message-to-another-waiting-for-message/153379/3 "2018-10-22T12:15:09Z")
> In first picture I have edit the multiline option in filebeat config file ![Screenshot%20from%202018-10-22%2017-03-11](https://us1.discourse-cdn.com/elastic/original/3X/3/6/36b04a99ee364f93007ee37eec68a55823f87f94.png) > In second picture when I search from "osama" it will just get me that particular line not the entire message ![Screenshot%20from%202018-10-22%2017-03-27](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0a8171e4d4bf3968e4d5e2fdce30c00d0f71bddf.png) > its not working i want the whole message > Thanks in advance ---
**Author:** ![nugusbayevkk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nugusbayevkk/32/126683_2.png) [@nugusbayevkk](https://discuss.elastic.co/u/nugusbayevkk)\ **Post date:** [October 22, 2018, 4:04pm UTC](https://discuss.elastic.co/t/i-have-a-log-file-in-which-i-will-search-with-a-specific-word-which-will-give-me-that-line-but-i-need-to-get-whole-message-started-from-waiting-for-message-to-another-waiting-for-message/153379/4 "2018-10-22T16:04:11Z")
you should delete one of the parameters: **multiline.match** and set **after** or **before** and try to change pattern with starting ^ ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/5/65ff1e2f911b24b1fcc831c9fe428261ff0d6852.png) filebeat.yml: > filebeat.prospectors: > > - type: log > enabled: true > paths: and used next test data: > 18/07/04 00:00:00 | main This is a new row.... > 18/07/04 00:00:00 | main G\_GetMsg XLI-38159714: Message Length Received [230] > 18/07/04 00:00:00 | main XLI-38159714: MessageSource [0028] > 18/07/04 00:00:00 | main company > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-011 6:[234548] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-012 6:[234748] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-013 4:[0703] > 18/07/04 00:00:00 | ProcessMessageXLI-38159714: DE-015 4:[0704] > 18/07/04 00:00:00 | main This is a new row.... > 18/07/04 00:00:00 | main G\_GetMsg XLI-38159714: Message Length Received [230] 18/07/04 00:00:00 | main XLI-38159714: MessageSource [0028] > 18/07/04 00:00:00 | main company > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-011 6:[234548] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-012 6:[234748] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-013 4:[0703] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-015 4:[0704] > 18/07/04 00:00:00 | main This is a new row.... > 18/07/04 00:00:00 | main This is a new row.... > 18/07/04 00:00:00 | main G\_GetMsg XLI-38159714: Message Length Received [230] > 18/07/04 00:00:00 | main XLI-38159714: MessageSource [0028] > 18/07/04 00:00:00 | main company > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-011 6:[234548] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-012 6:[234748] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-013 4:[0703] > 18/07/04 00:00:00 | ProcessMessage XLI-38159714: DE-015 > 4:[0704] 18/07/04 00:00:00 | main This is a new row.... ---
**Author:** ![osamaikhlas](https://avatars.discourse-cdn.com/v4/letter/o/4bbf92/32.png) [@osamaikhlas](https://discuss.elastic.co/u/osamaikhlas)\ **Post date:** [October 23, 2018, 7:27am UTC](https://discuss.elastic.co/t/i-have-a-log-file-in-which-i-will-search-with-a-specific-word-which-will-give-me-that-line-but-i-need-to-get-whole-message-started-from-waiting-for-message-to-another-waiting-for-message/153379/5 "2018-10-23T07:27:04Z")
after editing in filebeat file kibana is not loading the latest the file which i have edited in my folder and filebeat status failed to start. please help out. Thanks ![Screenshot%20from%202018-10-23%2012-22-34](https://us1.discourse-cdn.com/elastic/original/3X/3/4/34957642939d115654eaa765dde12d32c4047c25.png) ---
**Author:** ![nugusbayevkk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nugusbayevkk/32/126683_2.png) [@nugusbayevkk](https://discuss.elastic.co/u/nugusbayevkk)\ **Post date:** [October 23, 2018, 9:06am UTC](https://discuss.elastic.co/t/i-have-a-log-file-in-which-i-will-search-with-a-specific-word-which-will-give-me-that-line-but-i-need-to-get-whole-message-started-from-waiting-for-message-to-another-waiting-for-message/153379/6 "2018-10-23T09:06:35Z")
can you send your filebeat.yml? to [kanagat.nugusbayev@gmail.com](mailto:kanagat.nugusbayev@gmail.com) ---
**Author:** ![osamaikhlas](https://avatars.discourse-cdn.com/v4/letter/o/4bbf92/32.png) [@osamaikhlas](https://discuss.elastic.co/u/osamaikhlas)\ **Post date:** [October 23, 2018, 9:15am UTC](https://discuss.elastic.co/t/i-have-a-log-file-in-which-i-will-search-with-a-specific-word-which-will-give-me-that-line-but-i-need-to-get-whole-message-started-from-waiting-for-message-to-another-waiting-for-message/153379/7 "2018-10-23T09:15:32Z")
its resolve thanks a lot its very helpful. Now i need to know can i break the line when the next line starts while seeing the messages on kibana Thanks Man in Advance ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 20, 2018, 9:15am UTC](https://discuss.elastic.co/t/i-have-a-log-file-in-which-i-will-search-with-a-specific-word-which-will-give-me-that-line-but-i-need-to-get-whole-message-started-from-waiting-for-message-to-another-waiting-for-message/153379/8 "2018-11-20T09:15:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.